p.haul: use ssh tunneling by default
p.haul: bind service socket on 127.0.0.1